Device for quantifying vulnerability of system and method therefor

Abstract

A method and apparatus for quantifying the vulnerability of a system. The apparatus includes a vulnerability calculation unit, a target organization security level calculation unit, a network separation status calculation unit, an interim calculation unit, and a final score calculation unit. The vulnerability calculation unit converts each of the vulnerability identification results of the system into a vulnerability score. The target organization security level calculation unit calculates a target organization security level score based on a technology-field security level score and a management-field security level score. The network separation status calculation unit converts the status of the separation of the local network of the system into a network separation score. The interim calculation unit calculates an interim score. The final score calculation unit quantifies the vulnerability of the system by finally calculating a composite score using the interim score and a simulated intrusion success level.

Description

TECHNICAL FIELD[0001]The present invention relates, in general, to an apparatus and method for quantifying the vulnerability of a system and, more particularly, to an apparatus and method that quantify the vulnerability of a system in order to intuitively and objectively represent the state of the system.BACKGROUND ART[0002]Technology for analyzing and evaluating the vulnerability of information and communication systems is intended to previously identify vulnerabilities that exist in the corresponding system and eliminate the vulnerabilities based on the results of the identification. Accordingly, technology for analyzing and evaluating the vulnerability of information and communication systems enables vulnerabilities to be eliminated before being exploited for illegitimate intrusions, thereby preventing various types of intrusions from occurring. Furthermore, the results of analyzing or evaluating the vulnerability of a system are used for a method of intuitively transferring the ...

AI Technical Summary

Benefits of technology

This patent describes a way to evaluate the vulnerability of a system without relying on the opinion of the evaluator. The method assigns a score to the system based on objective measures, such as the strength of its security measures. This way, a system administrator can make informed decisions about which protective measures to take. The technical effect of this invention is that it provides a more accurate and consistent measure of a system's vulnerability.

Problems solved by technology

However, this conventional technology for analyzing or evaluating vulnerability provides merely an active and automated integrated cyber attack model that is capable of detecting and analyzing the vulnerability of a network or a system, but does not disclose technology for acquiring the results of intuitively or objectively evaluating vulnerability.

Meanwhile, if the results of analyzing or evaluating the vulnerability of a system are not quantified, it is difficult to represent the state of the system using a representative value.

For example, the result statement “a specific system is in a dangerous state because access control is insufficient because of lack of password management and the presence of an unnecessary service” may make a user confused.

Although it is definitely necessary to analyze or evaluate vulnerability, related research and development has not been sufficiently carried out.

Although the results of analyzing or evaluating vulnerability have been quantified using specific methods, the objectivity thereof cannot be accomplished.

A first reason for this is that the types of vulnerability that are used to calculate the score are limited.

A second reason for this is that the subjectivity of an analyzer is excessively involved.

Due to the above-described problems, the results of analyzing or evaluating vulnerability have low objectivity, and the analyzer cannot help modifying the results because of lack of a logical basis upon which the analyzer can refute the request to modify the results.